/// <summary> /// Adds an event message file to the cache. /// </summary> /// <param name="messageFile">An event message file.</param> public void Add(EventMessageFile messageFile) { if (messageFile != null) { string path = messageFile.Path.ToLower(CultureInfo.CurrentCulture); if (!string.IsNullOrEmpty(path)) { if (!_messageFiles.ContainsKey(path)) { _messageFiles.Add(path, messageFile); } else { Logger.Debug(CultureInfo.CurrentCulture, "Did not add message file '{0}' for '{1}' due to it being a duplicate", path, messageFile.FileName); } } else { Logger.Debug(CultureInfo.CurrentCulture, "Did not add message file for '{0}' due to an empty path", messageFile.FileName); } } }
/// <summary> /// Process all the entries in the EventMessageFile registry value. /// </summary> /// <param name="logName"></param> /// <param name="sourceName"></param> /// <param name="eventMessageFiles"></param> private void ProcessEventMessageFiles(string logName, string sourceName, string eventMessageFiles) { if (!string.IsNullOrEmpty(eventMessageFiles)) { string systemRootPath = Environment.GetEnvironmentVariable("systemroot").ToLower(CultureInfo.CurrentCulture); string winDirPath = Environment.GetEnvironmentVariable("windir").ToLower(CultureInfo.CurrentCulture); // fix up paths to be literal paths eventMessageFiles = eventMessageFiles.ToLower(CultureInfo.CurrentCulture); eventMessageFiles = eventMessageFiles.Replace("%systemroot%", systemRootPath); eventMessageFiles = eventMessageFiles.Replace(@"\systemroot", systemRootPath); eventMessageFiles = eventMessageFiles.Replace("%windir%", winDirPath); eventMessageFiles = eventMessageFiles.Replace("$(runtime.system32)", Environment.GetFolderPath(Environment.SpecialFolder.System)); //seen on Windows 8+ for WinHttpAutoProxySvc foreach (string messageFilePath in eventMessageFiles.Split(new string[] { ";" }, StringSplitOptions.RemoveEmptyEntries)) { // can't directly modify messageFilePath since it is part of the foreach string modifiedMessageFilePath = messageFilePath.Trim(); // some paths are missing a slash between %systemroot% and the rest of the path // one example is the EventMessageFile registry value for the Eventlog\System\vsmraid\ on Windows Vista // we do the same check for %windir% just to be safe if (modifiedMessageFilePath.StartsWith(systemRootPath, StringComparison.CurrentCultureIgnoreCase) && !modifiedMessageFilePath.StartsWith(systemRootPath + @"\", StringComparison.CurrentCultureIgnoreCase)) { modifiedMessageFilePath = modifiedMessageFilePath.Replace(systemRootPath, systemRootPath + @"\"); } if (modifiedMessageFilePath.StartsWith(winDirPath, StringComparison.CurrentCultureIgnoreCase) && !modifiedMessageFilePath.StartsWith(winDirPath + @"\", StringComparison.CurrentCultureIgnoreCase)) { modifiedMessageFilePath = modifiedMessageFilePath.Replace(winDirPath, winDirPath + @"\"); } // check to see if the messagefile has already been parsed // otherwise parse the messagefile and add it to the cache if (EventMessageFileCache.Instance.Contains(modifiedMessageFilePath)) { EventMessageFiles.Add(EventMessageFileCache.Instance.Get(modifiedMessageFilePath)); } else { string[] messageFilePaths = modifiedMessageFilePath.Split(new string[] { @"\" }, StringSplitOptions.RemoveEmptyEntries); if (messageFilePaths.Length > 0) { string file = messageFilePaths.Last(); if (!string.IsNullOrEmpty(file)) { EventMessageFile messageFile = new EventMessageFile(logName, sourceName, file, modifiedMessageFilePath); EventMessageFileCache.Instance.Add(messageFile); EventMessageFiles.Add(messageFile); } else { Logger.Debug(CultureInfo.CurrentCulture, "Message file name is empty '{0}'='{1}' for log '{2}' and source '{3}'", modifiedMessageFilePath, eventMessageFiles, logName, sourceName); } } else { Logger.Debug(CultureInfo.CurrentUICulture, "Message file path has no elements '{0}'='{1}' for log '{2}' and source '{3}'", modifiedMessageFilePath, eventMessageFiles, logName, sourceName); } } } } }